User management

A Veracode user is an individual with a user account on the Veracode Platform. The user account contains the user's email address and defines their permissions. To manage user permissions, we support role-based access control (RBAC) and grant users specific permissions based on their assigned roles.

Administrators and team administrators can manage users in the Veracode Platform and with the Identity API.

To create users or manage users in the Veracode Platform, from the gear menu in the upper-right corner, select Admin and select the Users tab.

Veracode user accounts

The Veracode Platform supports two user account types: UI user and API user. These accounts exist in specific Veracode regions.

UI user

A UI user account is for human users who interact with interfaces, such as the Veracode Platform, IDE integrations, the Veracode CLI, or the Veracode APIs. You typically create these users for your development and security teams. UI users can access the Veracode Platform and the Veracode APIs. The user's permissions are based on the assigned UI roles.

API user

An API user account is for non-human users, such as systems or services, that use the Veracode APIs. These users can only sign in to the Veracode Platform to manage their account settings and API credentials. For all other tasks, these users must use the Veracode APIs. The user's permissions are based on the assigned API roles.

These users are specifically designed for automations. For example, to automate an application analysis that runs unattended and without disruption, if the account is disabled or expires, use this account with the APIs.

Keep accounts active

To keep user accounts active, users must regularly sign in to their accounts. Users in the United States Federal region must sign in at least once every 90 days.

If a user uses API credentials, but doesn't sign in to their account regularly, the account is disabled immediately after the API credentials expire.

Role-based access control

We use role-based access control (RBAC) to manage user permissions and access to the Veracode Platform. Using RBAC, we grant permissions to users based on the roles assigned to their user accounts. Administrators assign roles when creating or editing a user's account, which enables them to grant specific permissions based on the user's responsibilities without managing individual permissions. For example, a security analyst might be assigned a role that grants access to scan results and remediation guidance, while an administrator would have broader access to user management and Veracode Platform configuration options.

Optionally, you can create custom roles with the Identity API.

User authentication

The Veracode Platform supports the following authentication methods for user's to sign in securely. You can use one of these methods or combine them, where appropriate.

• Strong passwords: required unless you are using SAML.

• Multifactor authentication: optional. Administrators can configure a user account to require the use of a second authentication factor for login.

• Single sign-on (SSO) with SAML: optional. Administrator can create a trust relationship between their organization's identity provider and Veracode, and configure individual users to authenticate via SAML.

  note

  You can't combine this option with a Veracode-provided token.

• Restricted IP ranges: optional. When creating or editing a user, Administrators can restrict the IP addresses, or ranges, from which the user is allowed to sign in to the Veracode Platform.